- The iPhone targeting malware was ported from Android to iOS
- It is said to be the first known version of the Gold Digger malware
- It is part of a cluster of banking trojans targeting the APAC region.iPhone devices are being targeted by a rare trojan called Gold Digger, a cybersecurity firm has reported. The malware is part of a cluster of aggressive banking trojans that have been affecting users in the Asia-Pacific (APAC) region. The earlier spotted malware group was only affecting Android users, but a new version has now been unearthed that specifically targets iOS and steals facial recognition data and other sensitive information from devices. This development is rare since Apple is known to be proactive in releasing security patches for its operating system.
Cybersecurity firm Group-IB was behind the discovery of the iOS trojan. The group has been tracking it since October 2023, when it first found a new variant of Android malware and named it Gold Digger. The malicious programme was found to be a banking trojan that steals financial information and targets banking apps, e-wallets, and crypto-wallets. It was first spotted in Vietnam but later identified as a cluster that was affecting the entire APAC region.
In its findings, the group noted that “a new sophisticated mobile Trojan specifically aimed at iOS users, dubbed GoldPickaxe.iOS by Group-IB” has been discovered. The malware is capable of stealing facial recognition data, identity documents, and can even intercept SMS.
The cybersecurity group also claimed that the threat actors behind the Gold Digger malware likely take advantage of face-swapping AI tools to create deepfakes based on the Face ID data. Then, using a combination of identity documents, access to SMS, and Face ID data, the hacker behind the programme can gain access to the victim’s iPhone and their banking apps. The threat actors then make repeated bank transactions to steal the victim’s money. As per Group-IB, this method of monetary theft was previously unseen.
It was reported that the malware was earlier distributed through the TestFlight app, which lets developers beta-test new features before rolling them out, however, it was quickly removed by Apple. Now, it is being spread through a multi-level social engineering technique which involves tricking the victims into installing a Mobile Device Management (MDM) profile.
